@le-space/rootfs 0.6.0 → 0.6.2

package/reference/ucan-store/rootfs/read-rootfs-contract.py

@@ -0,0 +1,72 @@
+#!/usr/bin/env python3
+
+from __future__ import annotations
+
+import argparse
+import json
+import shlex
+import sys
+from pathlib import Path
+
+
+def shell_assign(name: str, value: str) -> str:
+    return f"{name}={shlex.quote(value)}"
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description="Read a ucan-store rootfs contract and emit shell exports.")
+    parser.add_argument("contract", type=Path, help="Path to the rootfs contract JSON file")
+    args = parser.parse_args()
+
+    try:
+        payload = json.loads(args.contract.read_text())
+    except FileNotFoundError:
+        print(f"Missing rootfs contract: {args.contract}", file=sys.stderr)
+        return 1
+    except json.JSONDecodeError as exc:
+        print(f"Invalid rootfs contract JSON in {args.contract}: {exc}", file=sys.stderr)
+        return 1
+
+    rootfs = payload.get("rootfs") or {}
+    services = payload.get("services") or {}
+    source = payload.get("source") or {}
+    manifest = payload.get("manifest") or {}
+    ports = payload.get("ports") or []
+
+    profile = rootfs.get("profile")
+    install_mode = rootfs.get("installMode")
+
+    if not isinstance(profile, str) or not profile.strip():
+        print("Rootfs contract is missing rootfs.profile", file=sys.stderr)
+        return 1
+    if not isinstance(install_mode, str) or not install_mode.strip():
+        print("Rootfs contract is missing rootfs.installMode", file=sys.stderr)
+        return 1
+    if not isinstance(ports, list):
+        print("Rootfs contract field ports must be a list", file=sys.stderr)
+        return 1
+
+    lines = [
+        shell_assign("ROOTFS_CONTRACT_PATH", str(args.contract.resolve())),
+        shell_assign("ROOTFS_CONTRACT_ID", str(payload.get("id", ""))),
+        shell_assign("ROOTFS_CONTRACT_PROFILE", profile.strip()),
+        shell_assign("ROOTFS_CONTRACT_INSTALL_MODE", install_mode.strip()),
+        shell_assign("ROOTFS_CONTRACT_SOURCE_SUBDIRECTORY", str(source.get("subdirectory", ""))),
+        shell_assign("ROOTFS_CONTRACT_INSTALL_DIR", str(rootfs.get("installDir", ""))),
+        shell_assign("ROOTFS_CONTRACT_BINARY_PATH", str(rootfs.get("binaryPath", "/usr/local/bin/ucan-store"))),
+        shell_assign("ROOTFS_CONTRACT_DATA_DIR", str(rootfs.get("dataDir", ""))),
+        shell_assign("ROOTFS_CONTRACT_ENV_FILE", str(rootfs.get("envFile", ""))),
+        shell_assign("ROOTFS_CONTRACT_MAIN_SERVICE", str(services.get("main", ""))),
+        shell_assign("ROOTFS_CONTRACT_BOOTSTRAP_SERVICE", str(services.get("bootstrap", ""))),
+        shell_assign("ROOTFS_CONTRACT_AUTOTLS_SERVICE", str(services.get("autotlsRefresh", ""))),
+        shell_assign("ROOTFS_CONTRACT_MANIFEST_COPY_TARGET", str(manifest.get("copyTarget", ""))),
+        shell_assign("ROOTFS_CONTRACT_MANIFEST_NOTES", str(manifest.get("notes", ""))),
+        shell_assign("ROOTFS_CONTRACT_PORT_FORWARDS_JSON", json.dumps(ports, separators=(",", ":"))),
+    ]
+
+    print("\n".join(lines))
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/reference/ucan-store/rootfs/ucan-store-autotls-refresh.service

@@ -0,0 +1,12 @@
+[Unit]
+Description=Placeholder AutoTLS refresh hook for ucan-store
+After=ucan-store.service
+Wants=ucan-store.service
+ConditionPathExists=/etc/default/ucan-store.ready
+
+[Service]
+Type=oneshot
+ExecStart=/bin/true
+
+[Install]
+WantedBy=multi-user.target

package/reference/ucan-store/rootfs/ucan-store-bootstrap-verify.mjs

@@ -0,0 +1,409 @@
+#!/usr/bin/env node
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+const DEFAULT_WEB_ROOT = process.env.WEB_ROOT || '/opt/ucan-store/web';
+
+function parseArgs(argv) {
+  const args = {
+    packageFile: '',
+    adminDid: '',
+    runtimeServiceDid: '',
+    runtimeServiceOrigin: '',
+    webRoot: DEFAULT_WEB_ROOT,
+    summaryFile: '',
+  };
+
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index];
+    const value = argv[index + 1] ?? '';
+    switch (arg) {
+      case '--package-file':
+        args.packageFile = value;
+        index += 1;
+        break;
+      case '--admin-did':
+        args.adminDid = value;
+        index += 1;
+        break;
+      case '--runtime-service-did':
+        args.runtimeServiceDid = value;
+        index += 1;
+        break;
+      case '--runtime-service-origin':
+        args.runtimeServiceOrigin = value;
+        index += 1;
+        break;
+      case '--web-root':
+        args.webRoot = value;
+        index += 1;
+        break;
+      case '--summary-file':
+        args.summaryFile = value;
+        index += 1;
+        break;
+      case '-h':
+      case '--help':
+        printHelp();
+        process.exit(0);
+      default:
+        throw new Error(`Unknown argument: ${arg}`);
+    }
+  }
+
+  if (!args.packageFile) {
+    throw new Error('--package-file is required');
+  }
+
+  return args;
+}
+
+function printHelp() {
+  console.log(`Usage:
+  ucan-store-bootstrap-verify.mjs \\
+    --package-file <path> \\
+    [--admin-did <did>] \\
+    [--runtime-service-did <did>] \\
+    [--runtime-service-origin <origin>] \\
+    [--web-root <path>] \\
+    [--summary-file <path>]`);
+}
+
+function normalizeString(value) {
+  return typeof value === 'string' && value.trim() ? value.trim() : null;
+}
+
+function normalizeOrigin(value) {
+  const normalized = normalizeString(value);
+  if (!normalized) {
+    return null;
+  }
+  try {
+    const url = new URL(normalized);
+    if (!['http:', 'https:'].includes(url.protocol)) {
+      return null;
+    }
+    if ((url.pathname && url.pathname !== '/') || url.search || url.hash) {
+      return null;
+    }
+    return `${url.protocol}//${url.host}`;
+  } catch {
+    return null;
+  }
+}
+
+function base64UrlToBase64(value) {
+  const padded = value.replace(/-/g, '+').replace(/_/g, '/');
+  const remainder = padded.length % 4;
+  if (remainder === 0) {
+    return padded;
+  }
+  return padded + '='.repeat(4 - remainder);
+}
+
+function decodeProofString(proof) {
+  if (proof.startsWith('m')) {
+    return new Uint8Array(Buffer.from(proof.slice(1), 'base64'));
+  }
+  if (proof.startsWith('u')) {
+    return new Uint8Array(Buffer.from(base64UrlToBase64(proof.slice(1)), 'base64'));
+  }
+  throw new Error('Unsupported delegation proof multibase prefix');
+}
+
+function capabilityCovers(provided, required) {
+  if (provided === '*' || provided === required) {
+    return true;
+  }
+  if (provided.endsWith('/*')) {
+    const prefix = provided.slice(0, -1);
+    return required.startsWith(prefix);
+  }
+  return false;
+}
+
+function parsePackageSpecifier(specifier) {
+  if (specifier.startsWith('@')) {
+    const [scope, name, ...rest] = specifier.split('/');
+    return {
+      pkgName: `${scope}/${name}`,
+      subpath: rest.length ? `./${rest.join('/')}` : '.',
+    };
+  }
+  const [name, ...rest] = specifier.split('/');
+  return {
+    pkgName: name,
+    subpath: rest.length ? `./${rest.join('/')}` : '.',
+  };
+}
+
+async function resolveExportTarget(pkgRoot, subpath) {
+  const packageJsonPath = path.join(pkgRoot, 'package.json');
+  const raw = await fs.readFile(packageJsonPath, 'utf8');
+  const pkg = JSON.parse(raw);
+  const exportsField = pkg.exports;
+
+  if (!exportsField) {
+    return pkg.main ? path.join(pkgRoot, pkg.main) : null;
+  }
+
+  let target = null;
+  if (typeof exportsField === 'string') {
+    target = subpath === '.' ? exportsField : null;
+  } else if (exportsField[subpath]) {
+    target = exportsField[subpath];
+  } else if (subpath === '.' && exportsField['.']) {
+    target = exportsField['.'];
+  }
+
+  if (!target) {
+    return null;
+  }
+  if (typeof target === 'string') {
+    return path.join(pkgRoot, target);
+  }
+
+  const entry = target.import ?? target.default ?? target.require ?? null;
+  return entry ? path.join(pkgRoot, entry) : null;
+}
+
+async function resolveFromWebNodeModules(webRoot, specifier) {
+  const { pkgName, subpath } = parsePackageSpecifier(specifier);
+  const pkgRoot = path.join(webRoot, 'node_modules', pkgName);
+  return resolveExportTarget(pkgRoot, subpath);
+}
+
+function buildModuleLoader(webRoot) {
+  const packageJsonUrl = pathToFileURL(path.join(webRoot, 'package.json')).href;
+
+  return async (specifier) => {
+    let resolved = null;
+    if (typeof import.meta.resolve === 'function') {
+      try {
+        const resolvedUrl = import.meta.resolve(specifier, packageJsonUrl);
+        resolved = resolvedUrl.startsWith('file://')
+          ? fileURLToPath(resolvedUrl)
+          : resolvedUrl;
+      } catch {
+        resolved = null;
+      }
+    }
+    if (!resolved) {
+      resolved = await resolveFromWebNodeModules(webRoot, specifier);
+    }
+    return import(pathToFileURL(resolved).href);
+  };
+}
+
+async function parseDelegation(proof, importFromWeb) {
+  const bytes = decodeProofString(proof);
+  try {
+    const { extract } = await importFromWeb('@ucanto/core/delegation');
+    const extracted = await withMutedConsoleLog(() => extract(bytes));
+    if (extracted?.ok) {
+      return extracted.ok;
+    }
+    if (extracted && !extracted.error) {
+      return extracted;
+    }
+  } catch {
+    // Fall back to Storacha proof parser.
+  }
+
+  const Proof = await importFromWeb('@storacha/client/proof');
+  return withMutedConsoleLog(() => Proof.parse(proof));
+}
+
+async function verifyDelegationSignature(delegation, importFromWeb) {
+  const issuerDid = delegation?.issuer?.did?.();
+  if (!issuerDid) {
+    return { ok: false, error: 'Delegation issuer DID is missing.' };
+  }
+  if (!issuerDid.startsWith('did:key:')) {
+    return {
+      ok: false,
+      error: `Delegation issuer ${issuerDid} is not a did:key DID; bootstrap verification currently supports did:key issuers only.`,
+    };
+  }
+
+  const { Verifier } = await importFromWeb('@ucanto/principal');
+  const UCAN = await importFromWeb('@ipld/dag-ucan');
+  const verifier = Verifier.parse(issuerDid);
+  const valid = await withMutedConsoleLog(() =>
+    UCAN.verifySignature(delegation.data, verifier),
+  );
+  return valid
+    ? { ok: true }
+    : { ok: false, error: `Delegation signature verification failed for issuer ${issuerDid}.` };
+}
+
+async function withMutedConsoleLog(fn) {
+  const originalLog = console.log;
+  console.log = () => {};
+  try {
+    return await fn();
+  } finally {
+    console.log = originalLog;
+  }
+}
+
+async function main() {
+  const args = parseArgs(process.argv.slice(2));
+  const importFromWeb = buildModuleLoader(args.webRoot);
+  const errors = [];
+  const warnings = [];
+
+  const raw = await fs.readFile(args.packageFile, 'utf8');
+  const payload = JSON.parse(raw);
+  const adminDid = normalizeString(args.adminDid) ?? normalizeString(payload.adminDid);
+  const packageServiceDid = normalizeString(payload.serviceDid);
+  const runtimeServiceDid = normalizeString(args.runtimeServiceDid);
+  const runtimeServiceOrigin = normalizeOrigin(args.runtimeServiceOrigin);
+  const allowedCapabilities = Array.isArray(payload.allowedCapabilities)
+    ? payload.allowedCapabilities.map(normalizeString).filter(Boolean)
+    : [];
+  const spaceDid = normalizeString(payload.spaceDid);
+  const proof = normalizeString(payload.rootDelegationProof);
+
+  if (!proof) {
+    throw new Error('Bootstrap package rootDelegationProof is missing.');
+  }
+
+  const delegation = await parseDelegation(proof, importFromWeb);
+  const issuerDid = delegation?.issuer?.did?.() ?? null;
+  const audienceDid = delegation?.audience?.did?.() ?? null;
+  const capabilities = Array.isArray(delegation?.capabilities)
+    ? delegation.capabilities.map((capability) => ({
+        with: normalizeString(capability?.with) ?? null,
+        can: normalizeString(capability?.can) ?? null,
+      }))
+    : [];
+
+  if (!issuerDid) {
+    errors.push('Delegation issuer DID could not be determined.');
+  }
+  if (!audienceDid) {
+    errors.push('Delegation audience DID could not be determined.');
+  }
+
+  if (adminDid && issuerDid && adminDid !== issuerDid) {
+    errors.push(`Delegation issuer ${issuerDid} does not match configured admin DID ${adminDid}.`);
+  }
+
+  const expectedAudience = runtimeServiceDid ?? packageServiceDid;
+  if (expectedAudience && audienceDid && expectedAudience !== audienceDid) {
+    errors.push(
+      `Delegation audience ${audienceDid} does not match expected service DID ${expectedAudience}.`,
+    );
+  }
+
+  if (runtimeServiceDid && packageServiceDid && runtimeServiceDid !== packageServiceDid) {
+    errors.push(
+      `Runtime service DID ${runtimeServiceDid} does not match bootstrap package serviceDid ${packageServiceDid}.`,
+    );
+  }
+
+  const signatureCheck = await verifyDelegationSignature(delegation, importFromWeb);
+  if (!signatureCheck.ok) {
+    errors.push(signatureCheck.error);
+  }
+
+  const nowSeconds = Math.floor(Date.now() / 1000);
+  const expiration =
+    typeof delegation?.expiration === 'number' && Number.isFinite(delegation.expiration)
+      ? delegation.expiration
+      : null;
+  const notBefore =
+    typeof delegation?.notBefore === 'number' && Number.isFinite(delegation.notBefore)
+      ? delegation.notBefore
+      : null;
+
+  if (expiration !== null && expiration <= nowSeconds) {
+    errors.push(`Delegation expired at ${new Date(expiration * 1000).toISOString()}.`);
+  }
+  if (notBefore !== null && notBefore > nowSeconds) {
+    errors.push(`Delegation is not valid before ${new Date(notBefore * 1000).toISOString()}.`);
+  }
+
+  if (spaceDid) {
+    const invalidScopes = capabilities.filter(
+      (capability) => capability.with && capability.with !== spaceDid,
+    );
+    if (invalidScopes.length > 0) {
+      warnings.push(
+        `Delegation contains capabilities outside the configured space DID ${spaceDid}.`,
+      );
+    }
+  }
+
+  const missingCapabilities = [];
+  for (const requiredCapability of allowedCapabilities) {
+    const covered = capabilities.some(
+      (capability) =>
+        capability.with === spaceDid &&
+        capability.can &&
+        capabilityCovers(capability.can, requiredCapability),
+    );
+    if (!covered) {
+      missingCapabilities.push(requiredCapability);
+    }
+  }
+  if (missingCapabilities.length > 0) {
+    errors.push(
+      `Delegation does not cover required capabilities: ${missingCapabilities.join(', ')}.`,
+    );
+  }
+
+  const packageServiceOrigin = normalizeOrigin(payload.serviceOrigin);
+  if (runtimeServiceOrigin && packageServiceOrigin && runtimeServiceOrigin !== packageServiceOrigin) {
+    errors.push(
+      `Runtime service origin ${runtimeServiceOrigin} does not match bootstrap package serviceOrigin ${packageServiceOrigin}.`,
+    );
+  }
+
+  const summary = {
+    status: errors.length === 0 ? 'valid' : 'invalid',
+    valid: errors.length === 0,
+    errors,
+    warnings,
+    verification: {
+      issuerDid,
+      audienceDid,
+      adminDid,
+      packageServiceDid,
+      runtimeServiceDid,
+      runtimeServiceOrigin,
+      packageServiceOrigin,
+      spaceDid,
+      signatureValid: signatureCheck.ok,
+      expiration,
+      notBefore,
+      capabilities,
+      allowedCapabilities,
+      missingCapabilities,
+    },
+  };
+
+  if (args.summaryFile) {
+    await fs.mkdir(path.dirname(args.summaryFile), { recursive: true });
+    await fs.writeFile(args.summaryFile, `${JSON.stringify(summary, null, 2)}\n`, 'utf8');
+  }
+
+  process.stdout.write(`${JSON.stringify(summary)}\n`);
+  if (!summary.valid) {
+    process.exitCode = 1;
+  }
+}
+
+main().catch((error) => {
+  const summary = {
+    status: 'invalid',
+    valid: false,
+    errors: [error instanceof Error ? error.message : String(error)],
+    warnings: [],
+    verification: null,
+  };
+  process.stdout.write(`${JSON.stringify(summary)}\n`);
+  process.exitCode = 1;
+});

package/reference/ucan-store/rootfs/ucan-store-bootstrap.service

@@ -0,0 +1,21 @@
+[Unit]
+Description=Temporary ucan-store setup endpoint
+Wants=network-online.target
+After=network-online.target
+ConditionPathExists=!/etc/default/ucan-store.ready
+
+[Service]
+Environment=ENV_FILE=/etc/default/ucan-store
+Environment=READY_FILE=/etc/default/ucan-store.ready
+Environment=SERVICE_NAME=ucan-store.service
+Environment=BOOTSTRAP_SERVICE=ucan-store-bootstrap.service
+Environment=METADATA_FILE=/run/ucan-store-setup-metadata.json
+Environment=METADATA_ERROR_FILE=/run/ucan-store-setup-metadata.error
+ExecStart=/usr/bin/python3 /usr/local/sbin/ucan-store-setup-server.py
+StandardOutput=journal
+StandardError=journal
+Restart=on-failure
+RestartSec=2s
+
+[Install]
+WantedBy=multi-user.target

package/reference/ucan-store/rootfs/ucan-store-bootstrap.sh

@@ -0,0 +1,155 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+INSTALL_DIR="${INSTALL_DIR:-/opt/ucan-store}"
+SERVICE_USER="${SERVICE_USER:-ucan-store}"
+DATA_DIR="${DATA_DIR:-/var/lib/ucan-store}"
+ENV_FILE="${ENV_FILE:-/etc/default/ucan-store}"
+READY_FILE="${READY_FILE:-/etc/default/ucan-store.ready}"
+BOOTSTRAP_PACKAGE_FILE="${BOOTSTRAP_PACKAGE_FILE:-/etc/ucan-store/bootstrap-package.json}"
+BOOTSTRAP_VERIFICATION_FILE="${BOOTSTRAP_VERIFICATION_FILE:-/etc/ucan-store/bootstrap-verification.json}"
+APP_BINARY="${APP_BINARY:-/usr/local/bin/ucan-store}"
+NODE_MIN_MAJOR="${NODE_MIN_MAJOR:-22}"
+UPLOAD_API_CONTEXT_TEMPLATE="${UPLOAD_API_CONTEXT_TEMPLATE:-/usr/local/share/ucan-store/ucan-store-upload-api-context.js}"
+UPLOAD_API_SERVICE_IDENTITY_TEMPLATE="${UPLOAD_API_SERVICE_IDENTITY_TEMPLATE:-/usr/local/share/ucan-store/ucan-store-upload-api-service-identity.js}"
+PHASE="${1:-all}"
+
+if [ ! -d "${INSTALL_DIR}" ]; then
+  echo "Missing ${INSTALL_DIR}; the rootfs build did not copy ucan-store." >&2
+  exit 1
+fi
+
+write_env_var() {
+  local key="$1"
+  local value="$2"
+
+  if grep -Eq "^[#[:space:]]*${key}=" "${ENV_FILE}"; then
+    sed -i "s|^[#[:space:]]*${key}=.*|${key}=${value}|" "${ENV_FILE}"
+  else
+    printf '%s=%s\n' "${key}" "${value}" >> "${ENV_FILE}"
+  fi
+}
+
+run_phase_base() {
+  export DEBIAN_FRONTEND=noninteractive
+  apt-get update
+  apt-get install -y ca-certificates curl gnupg caddy python3
+
+  if ! command -v node >/dev/null 2>&1 || [ "$(node -p "process.versions.node.split('.')[0]" 2>/dev/null || echo 0)" -lt "${NODE_MIN_MAJOR}" ]; then
+    curl -fsSL https://deb.nodesource.com/setup_22.x | bash -
+    apt-get install -y nodejs
+  fi
+
+  rm -rf /var/lib/apt/lists/*
+}
+
+run_phase_build() {
+  if [ ! -f "${INSTALL_DIR}/web/package.json" ]; then
+    echo "Missing ${INSTALL_DIR}/web/package.json" >&2
+    exit 1
+  fi
+  if [ ! -f "${INSTALL_DIR}/web/package-lock.json" ]; then
+    echo "Missing ${INSTALL_DIR}/web/package-lock.json" >&2
+    exit 1
+  fi
+
+  mkdir -p "${DATA_DIR}" "$(dirname "${ENV_FILE}")"
+  if ! id "${SERVICE_USER}" >/dev/null 2>&1; then
+    useradd --system --home "${DATA_DIR}" --create-home --shell /usr/sbin/nologin "${SERVICE_USER}"
+  fi
+
+  chown -R "${SERVICE_USER}:${SERVICE_USER}" "${DATA_DIR}" "${INSTALL_DIR}"
+
+  if command -v runuser >/dev/null 2>&1; then
+    runuser -u "${SERVICE_USER}" -- env HOME="${DATA_DIR}" bash -lc "cd '${INSTALL_DIR}/web' && npm ci"
+  else
+    echo "runuser is required to install npm dependencies as ${SERVICE_USER}" >&2
+    exit 1
+  fi
+
+  install_upload_api_context_override
+
+  rm -rf "${DATA_DIR}/.npm" "${INSTALL_DIR}/web/node_modules/.cache"
+}
+
+install_upload_api_context_override() {
+  local helper_dir="${INSTALL_DIR}/web/node_modules/@storacha/upload-api/dist/test/helpers"
+  mkdir -p "${helper_dir}"
+
+  if [ ! -f "${UPLOAD_API_CONTEXT_TEMPLATE}" ]; then
+    echo "Missing upload-api context template: ${UPLOAD_API_CONTEXT_TEMPLATE}" >&2
+    exit 1
+  fi
+  if [ ! -f "${UPLOAD_API_SERVICE_IDENTITY_TEMPLATE}" ]; then
+    echo "Missing upload-api service identity template: ${UPLOAD_API_SERVICE_IDENTITY_TEMPLATE}" >&2
+    exit 1
+  fi
+
+  cp "${UPLOAD_API_CONTEXT_TEMPLATE}" "${helper_dir}/context.js"
+  cp "${UPLOAD_API_SERVICE_IDENTITY_TEMPLATE}" "${helper_dir}/ucan-store-service-identity.js"
+  chown "${SERVICE_USER}:${SERVICE_USER}" "${helper_dir}/context.js" "${helper_dir}/ucan-store-service-identity.js"
+}
+
+run_phase_finalize() {
+  mkdir -p "${DATA_DIR}" "$(dirname "${ENV_FILE}")" /etc/caddy "$(dirname "${BOOTSTRAP_PACKAGE_FILE}")"
+  chown -R "${SERVICE_USER}:${SERVICE_USER}" "${DATA_DIR}" "${INSTALL_DIR}"
+
+  cat > "${APP_BINARY}" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+exec /usr/bin/node /opt/ucan-store/local-storacha-api/index.mjs "$@"
+EOF
+  chmod 0755 "${APP_BINARY}"
+
+  touch "${ENV_FILE}"
+  chmod 0640 "${ENV_FILE}"
+  chown "root:${SERVICE_USER}" "${ENV_FILE}"
+  rm -f "${READY_FILE}"
+
+  write_env_var "NODE_ENV" "production"
+  write_env_var "STORACHA_LOCAL_PORT" "8787"
+  write_env_var "UCAN_STORE_PROXY_PORT" "8788"
+  write_env_var "UCAN_STORE_SERVICE_KEY_ALGORITHM" "ed25519"
+  write_env_var "UCAN_STORE_SERVICE_SIGNER_FILE" "${DATA_DIR}/service-ed25519.key"
+  write_env_var "UCAN_STORE_SERVICE_DID" ""
+  write_env_var "UCAN_STORE_ADMIN_API_TOKEN" ""
+  write_env_var "WEBAUTHN_ORIGIN" "http://localhost:5173"
+  write_env_var "WEBAUTHN_ORIGIN_FALLBACKS" ""
+  write_env_var "UCAN_STORE_ADMIN_DID" ""
+  write_env_var "UCAN_STORE_BOOTSTRAP_PACKAGE_FILE" "${BOOTSTRAP_PACKAGE_FILE}"
+  write_env_var "UCAN_STORE_BOOTSTRAP_VERIFICATION_FILE" "${BOOTSTRAP_VERIFICATION_FILE}"
+  write_env_var "UCAN_STORE_REQUIRE_BOOTSTRAP_PACKAGE" "1"
+  write_env_var "BOOTSTRAP_VERIFICATION_TIMEOUT_SECONDS" "60"
+  write_env_var "BOOTSTRAP_VERIFICATION_INTERVAL_SECONDS" "2"
+  write_env_var "PUBLIC_IPV4" ""
+  write_env_var "PUBLIC_IPV6" ""
+  write_env_var "PROXY_HOSTNAME" ""
+  write_env_var "PUBLIC_UPLOAD_SERVICE_URL" ""
+  write_env_var "PUBLIC_UPLOAD_SERVICE_DID" ""
+  write_env_var "PUBLIC_REVOCATION_URL" ""
+  write_env_var "PUBLIC_REVOCATION_DID" ""
+  write_env_var "PUBLIC_RECEIPTS_URL" ""
+
+  rm -f "${BOOTSTRAP_PACKAGE_FILE}" "${BOOTSTRAP_VERIFICATION_FILE}"
+}
+
+case "${PHASE}" in
+  base)
+    run_phase_base
+    ;;
+  build)
+    run_phase_build
+    ;;
+  finalize)
+    run_phase_finalize
+    ;;
+  all)
+    run_phase_base
+    run_phase_build
+    run_phase_finalize
+    ;;
+  *)
+    echo "Unknown phase: ${PHASE}" >&2
+    exit 1
+    ;;
+esac